Cloudanix VulnDB

CVE-2024-21110

High · 7.3

CVSS

7.3

EPSS

0.5%

Published

Apr 16, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in VirtualBox lets someone who already has basic access to the computer trick another user into doing something that gives the attacker full control over all virtual machines running on that computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows a low-privileged local attacker to achieve full control over the VirtualBox process on the host after a second user performs an interaction, resulting in arbitrary code execution and hypervisor takeover.

Why it matters to the business

Attackers can escape guest isolation, access or modify all virtual machines on the host, and compromise the underlying infrastructure, increasing risk of data breach and operational disruption for organizations using affected versions.

How an attack unfolds

An attacker logs into the host system with low privileges, then tricks another user into performing an action such as launching or interacting with a specially crafted virtual machine or guest component, triggering the flaw to elevate privileges and seize control of the VirtualBox application.

How to fix it

Upgrade Oracle VM VirtualBox to version 7.0.16 or later on all affected hosts. Verify the installed version after patching and remove or isolate any unpatched instances.

How to confirm the fix worked

Confirm the running VirtualBox version is 7.0.16 or newer via the application UI or command-line tools, then test that previously vulnerable guest operations no longer grant elevated host access.

Typical attack path

  1. Obtain low-privileged local access to the host running VirtualBox
  2. Prepare and deliver a malicious guest VM or related artifact
  3. Induce a second user to interact with the artifact (e.g., start the VM)
  4. Exploit the core flaw during interaction to escalate privileges
  5. Take over the VirtualBox process and all hosted VMs

How to detect it

Review host logs for VirtualBox process launches or crashes coinciding with unexpected privilege changes, inspect guest VM files or attachments for unusual content, and correlate user activity around the time of suspected exploitation.

What your security team should do

  • Immediately inventory all VirtualBox installations and prioritize upgrade to 7.0.16+
  • Restrict local logons on hosts running VirtualBox to the minimum necessary users
  • Monitor for unusual VirtualBox process behavior or unexpected VM interactions
  • Apply least-privilege principles to host accounts and guest VM access

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 kmod-virtualbox 0 7.0.18-48.mga9
Mageia:9 virtualbox 0 7.0.18-1.mga9
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS virtualbox 0 7.0.16-dfsg-2
Ubuntu:24.10 virtualbox 0 7.0.16-dfsg-2
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix

Related vulnerabilities